STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

Apple iOS/iPadOS 26 Security Technical Implementation Guide

Version

V1R2

Benchmark ID

Apple_iOS-iPadOS_26_STIG

Total Checks

92

Tags

mobile
CAT I: 3CAT II: 61CAT III: 28

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSON

Checks (92)

V-278697LOWApple iOS/iPadOS 26 must allow the administrator (MDM) to perform the following management function: enable/disable VPN protection across the device and [selection: on a per-app basis, on a per-group of applications processes basis].V-278718MEDIUMApple iOS/iPadOS 26 must not allow backup to remote systems (iCloud).V-278719MEDIUMApple iOS/iPadOS 26 must not allow backup to remote systems (iCloud document and data synchronization).V-278720MEDIUMApple iOS/iPadOS 26 must not allow backup to remote systems (iCloud Keychain).V-278721MEDIUMApple iOS/iPadOS 26 must not allow backup to remote systems (Cloud Photo Library).V-278722MEDIUMApple iOS/iPadOS 26 must not allow backup to remote systems (iCloud Photo Sharing, also known as Shared Stream or Shared Photo Stream).V-278723MEDIUMApple iOS/iPadOS 26 must not allow backup to remote systems (managed applications data stored in iCloud).V-278724MEDIUMApple iOS/iPadOS 26 must not allow backup to remote systems (enterprise books).V-278747MEDIUMApple iOS/iPadOS 26 must be configured to enforce a minimum password length of six characters.V-278748MEDIUMApple iOS/iPadOS 26 must be configured to not allow passwords that include more than four repeating or sequential characters.V-278750MEDIUMApple iOS/iPadOS 26 must be configured to lock the display after 15 minutes (or less) of inactivity.V-278751MEDIUMApple iOS/iPadOS 26 must be configured to not allow more than 10 consecutive failed authentication attempts.V-278752HIGHApple iOS/iPadOS 26 must be configured to enforce a passcode reuse prohibition of at least two generations.V-278753MEDIUMApple iOS/iPadOS 26 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DOD-approved commercial app repository, MDM server, mobile application store].V-278755MEDIUMApple iOS/iPadOS 26 must not include applications with the following characteristics: access to Siri when the device is locked.V-278757MEDIUMApple iOS/iPadOS 26 allow list must be configured to not include applications with the following characteristics: - Backs up MD data to non-DOD cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DOD servers; - Allows synchronization of data or applications between devices associated with user; - Allows unencrypted (or encrypted but not FIPS 140-3-validated) data sharing with other MDs or printers; and - Backs up own data to a remote system.V-278758MEDIUMApple iOS/iPadOS 26 must be configured to not display notifications when the device is locked.V-278759MEDIUMApple iOS/iPadOS 26 must not display notifications (calendar information) when the device is locked.V-278767LOWApple iOS/iPadOS 26 must be configured to display the DOD advisory warning message at startup or each time the user unlocks the device.V-278773MEDIUMApple iOS/iPadOS 26 must be configured to not allow backup of [all applications, configuration data] to locally connected systems.V-278777MEDIUMApple iOS/iPadOS 26 must not allow non-DOD applications to access DOD data.V-278778MEDIUMApple iPadOS 26 must be configured to disable multiuser modes.V-278779MEDIUMApple iOS/iPadOS 26 must be configured to [selection: wipe protected data, wipe sensitive data] upon unenrollment from MDM.V-278780MEDIUMApple iOS/iPadOS 26 must be configured to [selection: remove Enterprise applications, remove all noncore applications (any nonfactory-installed application)] upon unenrollment from MDM.V-278782MEDIUMApple iOS/iPadOS 26 must be configured to disable ad hoc wireless client-to-client connection capability.V-278784HIGHApple iOS/iPadOS 26 must require a valid password be successfully entered before the mobile device data is unencrypted.V-278786LOWApple iOS/iPadOS 26 must implement the management setting: limit Ad Tracking.V-278787LOWApple iOS/iPadOS 26 must implement the management setting: not allow automatic completion of Safari browser passcodes.V-278788MEDIUMApple iOS/iPadOS 26 must implement the management setting: encrypt backups/Encrypt local backup.V-278789LOWApple iOS/iPadOS 26 must implement the management setting: not allow use of Handoff.V-278790LOWApple iOS/iPadOS 26 must implement the management setting: not allow use of iPhone widgets on Mac.V-278791LOWApple iOS/iPadOS 26 must implement the management setting: require the user to enter a password when connecting to an AirPlay-enabled device.V-278792MEDIUMApple iOS/iPadOS 26 must implement the management setting: disable Allow MailDrop.V-278793HIGHiPhone and iPad must have the latest available iOS/iPadOS operating system installed.V-278794MEDIUMApple iOS/iPadOS 26 must implement the management setting: use SSL for Exchange ActiveSync.V-278795MEDIUMApple iOS/iPadOS 26 must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple iOS/iPadOS 26 Mail app.V-278796MEDIUMApple iOS/iPadOS 26 must implement the management setting: treat AirDrop as an unmanaged destination.V-278797LOWApple iOS/iPadOS 26 must implement the management setting: not have any Family Members in Family Sharing.V-278798MEDIUMApple iOS/iPadOS 26 must implement the management setting: not share location data through iCloud.V-278799LOWApple iOS/iPadOS 26 must implement the management setting: force Apple Watch wrist detection.V-278800MEDIUMApple iOS/iPadOS 26 users must complete required training.V-278801MEDIUMA managed photo app must be used to take and store work-related photos.V-278803MEDIUMApple iOS/iPadOS 26 must implement the management setting: enable USB Restricted Mode.V-278804LOWApple iOS/iPadOS 26 must not allow managed apps to write contacts to unmanaged contacts accounts.V-278805LOWApple iOS/iPadOS 26 must not allow unmanaged apps to read contacts from managed contacts accounts.V-278806MEDIUMApple iOS/iPadOS 26 must implement the management setting: disable AirDrop.V-278807MEDIUMApple iOS/iPadOS 26 must implement the management setting: disable paired Apple Watch.V-278809MEDIUMApple iOS/iPadOS 26 must disable "Password AutoFill" in browsers and applications.V-278810MEDIUMApple iOS/iPadOS 26 must disable "Allow setting up new nearby devices".V-278811MEDIUMApple iOS/iPadOS 26 must disable password proximity requests.V-278812MEDIUMApple iOS/iPadOS 26 must disable password sharing.V-278813LOWApple iOS/iPadOS 26 must disable "Find My Friends" in the "Find My" app.V-278814MEDIUMThe Apple iOS/iPadOS 26 must be supervised by the MDM.V-278815MEDIUMApple iOS/iPadOS 26 must disable "Allow USB drive access in Files app" if the authorizing official (AO) has not approved the use of DOD-approved USB storage drives with iOS/iPadOS devices.V-278816LOWThe Apple iOS must be configured to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled.V-278817MEDIUMApple iOS must implement the management setting: not allow a user to remove Apple iOS configuration profiles that enforce DOD security requirements.V-278818MEDIUMApple iOS/iPadOS 26 must disable "Allow network drive access in Files access".V-278819MEDIUMApple iOS/iPadOS 26 must disable connections to Siri servers for the purpose of dictation.V-278820MEDIUMApple iOS/iPadOS 26 must disable connections to Siri servers for the purpose of translation.V-278821MEDIUMApple iOS/iPadOS 26 must disable copy/paste of data from managed to unmanaged applications.V-278822MEDIUMApple iOS/iPadOS 26 must have DOD root and intermediate PKI certificates installed.V-278823MEDIUMApple iOS/iPadOS 26 must be configured to disable "Auto Unlock" of the iPhone by an Apple Watch.V-278824MEDIUMApple iOS/iPadOS 26 must disable the installation of alternative marketplace apps.V-278825MEDIUMApple iOS/iPadOS 26 must disable app installation from a website.V-278826MEDIUMApple iOS/iPadOS 26 must delete eSIM content when the device is erased.V-278827MEDIUMApple iOS/iPadOS 26 must disable ChatGPT connection for Apple Intelligence.V-278828MEDIUMApple iOS/iPadOS 26 must disable the download of iOS/iPadOS beta updates.V-278829MEDIUMApple iOS/iPadOS 26 must disable the ability to hide apps.V-278830MEDIUMApple iOS/iPadOS 26 must disable recording cell phone calls on the iPhone.V-278831MEDIUMApple iOS/iPadOS 26 must disable iPhone Mirroring on Mac.V-278832MEDIUMApple iOS/iPadOS 26 must disable the ability of the user to wipe the device.V-278833LOWApple iOS/iPadOS 26 must disable the use voice assistant (Siri) unless required to meet Section 508 compliance requirements.V-278834LOWApple iOS/iPadOS 26 must disable the use voice assistant (Show user-generated content in Siri) unless required to meet Section 508 compliance requirements.V-278835LOWApple iOS/iPadOS 26 must disable the use voice assistant (Siri suggestions) unless required to meet Section 508 compliance requirements.V-278836MEDIUMApple iOS/iPadOS 26 must disable automatic downloads of apps purchased on other Apple devices.V-278837MEDIUMApple iOS/iPadOS 26 must disable pairing with a host Mac or PC.V-278838LOWApple iOS/iPadOS 26 must disable AirPrint.V-278839LOWApple iOS/iPadOS 26 must disable AirPrint: Allow discovery of AirPrint printers using iBeacons.V-278840LOWApple iOS/iPadOS 26 must disable AirPrint: Allow storage of AirPrint credentials in Keychain.V-278841LOWApple iOS/iPadOS 26 must allow AirPrint feature: Disallow AirPrint to destinations with untrusted certificates.V-278842LOWApple iOS/iPadOS 26 must disable Allowed Content Ratings (Movies).V-278843LOWApple iOS/iPadOS 26 must disable Allowed Content Ratings (TV Shows).V-278844LOWApple iOS/iPadOS 26 must disable Apple Intelligence feature: Image Wand.V-278845LOWApple iOS/iPadOS 26 must disable Apple Intelligence feature: Image Generation.V-278846LOWApple iOS/iPadOS 26 must disable Apple Intelligence feature: generate new Genmoji.V-278847MEDIUMDOD Apple iOS/iPadOS 26 devices must have a Mobile Threat Detection (MTD) app installed.V-278848LOWDOD Apple iOS/iPadOS 26 devices must disable FaceTime.V-278849LOWDOD Apple iOS/iPadOS 26 devices must disable eSIM transfers.V-278850LOWDOD Apple iOS/iPadOS 26 devices must disable screenshots and screen recordings.V-278851MEDIUMApple iOS/iPadOS 26 must implement the management setting: disable Camera.V-278852MEDIUMApple iOS/iPadOS 26 must implement the management setting: disable the Bluetooth radio.V-278853MEDIUMApple iOS/iPadOS 26 must be configured to disable Wi-Fi Aware.